Hosted AI model identities verified using user-visible summary watermarks
Auditor-Assisted Summary-Channel Verification for Hosted LLM Identity Substitution
Cryptography and SecurityArtificial Intelligence
Summary
When using online AI services, it can be hard to tell which exact AI model answered a question. The authors propose a way for trusted auditors to check if the AI output really came from the claimed model by looking at special summary messages that the user can see. They create a system called SUMMARK that trains small adapters to embed model-specific signals in these summaries. This lets auditors spot if someone tries to fake or substitute the AI model without needing to see inside the AI system itself.
What this means in practice
- •For ai platform operators: Detect when a hosted LLM service returns responses from a different model than claimed to preserve transparency.
- •For product security teams: Verify AI model identities remotely without internal logs, helping ensure product claims about AI capabilities and origins.
Authors
Ziyi Zhang, Ziyao Wang, Guoheng Sun, Ang Li, Jian Li
Abstract
Hosted LLM services increasingly expose model identity as a product claim, but external users and auditors often cannot inspect which model configuration served a request. We study an auditor-assisted regime in which a trusted auditor enrolls claimed identities and prepares verification material before deployment, while audit-time verification uses only the claimed identity and released output, without runtime access to model internals, inference logs, routing decisions, or provider metadata. We propose SUMMARK, a summary-channel watermarking framework that uses user-visible reasoning summaries as a keyed audit surface. During setup, SUMMARK constructs identity-specific vocabulary carriers, trains lightweight summary adapters, and calibrates per-identity thresholds. At deployment time, a keyed statistical test assesses whether the released summary is consistent with the claimed identity and, when needed, attributes the most likely enrolled identity. Across model families, scales, and task domains, SUMMARK reliably detects cross-family and cross-scale substitutions at low false-positive rates while preserving task-facing answer quality. We further study FP16->INT8/INT4 precision-consistency diagnostics and robustness under bounded post-processing, rewriting stress tests, and text-only spoofing, revealing both strong performance and clear failure boundaries. Our code is publicly available at https://github.com/trinitr0toluene/Summark.